Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-29 06:55Z
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63888 — Linux: KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63888

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCS CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63887 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63887

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_b CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63886 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63886

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there i CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63885 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the ol CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63867 — Linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet a CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63866 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63866

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63865 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63865

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63864 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63864

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added visit_tailcall_insn() but did not check its return value. CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63863 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63863

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() There is a unbalanced lock/unlock to gpusvm notifier lock: [ 931.045868] ===================================== [ 931.046509] WARNING: bad unlock balance detected! [ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U [ 931.048150] ------------------------------------- [ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->n CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 15:16Z
HIGH

CVE-2026-63860 — Linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63860

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING. As the code has been this way for long time, it seems to me that userspace does include the terminating CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 15:16Z
CRIT

CVE-2026-63857 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragmen CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63832 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63832

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authentica CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63831 — Linux: This is the same pattern used by: - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c) - MACsec (drivers/net/macsec.c)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63831

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cryptographic transformations on skb data. They build a scatterlist with sg_init_one() pointing into the skb's linear data area and then pass the same scatterlist as both src and dst to the crypto API (e.g. crypto_skciphe CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 12:16Z
CRIT

CVE-2026-63830 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63830

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact CVSSv3.1 9.4 (CRITICAL)

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63829 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63829

In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunn CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63828 — Linux: In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63828

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Med CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 12:16Z
CRIT

CVE-2026-63825 — Linux: Since GCOV counters are global (not per-CPU), concurrent execution on different CPUs causes the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63825

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflate_fast(), the inner copy loops get transformed so that the GCOV counter value is loaded multiple times to compute the loop base address, start index, and end bound. Since GCOV counters are global (not per-CPU), concurrent e CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63818 — Linux: In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63818

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2f CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63815 — Linux: Mounting a crafted image and reading such a directory triggers an out-of-bounds read in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 12:16Z
CRIT

CVE-2026-63808 — Linux: In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63808

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() dr CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63807 — Linux: Failure to pre-check the validity of the gfn can lead to an out-of-bounds access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63807

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically m CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63801 — Linux: In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63801

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 12:16Z
CRIT

CVE-2026-63800 — Linux: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_p CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63797 — Linux: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63797

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_ch CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 12:16Z
HIGH

CVE-2026-63796 — Linux: Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63796

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap. Add a physical-cap check based on ocfs2_group_bitmap_size() CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score